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OPC-MCR Mathematical Information Processing Research Task: 

TOR deanonymisation 



Customer: ICTR-NE MCR lead: 

Status: in pullthrough (started Team: m 

December 2010) (ICTR-NE) 

Can we denonymise TOR ? In 
other words, if given some 
traffic from a TOR exit node, 
can we find the IP address of 
the user associated with that 
traffic? 



[edit] Research 



A circuit tracing attack was 
first considered. However 
ICTR-NE signatures run by 
TDSD showed that our 
coverage of TOR is too low to 
have a reasonable chance of 
doing such an attack; on 
JTRIG paths we only saw 2 
out of 8294 potential inter- 
TOR-node links. 

v • d • e 

Instead we are now 

considering an entry-exit correlation attack. Data collected from 
ICTR-NE/JTRIG infrastructure showed that some timing structure is 
preserved between entry and exit node. 
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The successful outcome of this entry-exit correlation attack is documented in 
OPC-M/TECH.B/61 . An R package implementing the attack is available: src. 
doc. 



The work was presented at SANAR11 . The slides are here . 

We plan to prototype the technique in the REMATION II workshop. The 
introductory slides are here . 




Categories : OPC-MCR MIP task | OPC-MCR in nullthrouah MIP task | 
OPC-MCR MIP task for ICTR-NE | Internet Anonymity | The Onion Router 
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